Intrusion Detection Systems

learn more… | top users | synonyms (2)

0
votes
1answer
64 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
2
votes
1answer
445 views

How to add wildcards to snort rule ip address?

Is it possible to add wildcards or something that would function like them to a snort rule IP address? For example: If I'd like to detect source-ip of: 192.168.*.9 Where the third octet can be ...
5
votes
1answer
116 views

Integrity check against package repository?

I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates. From time to time I want to boot from a clean boot ...
1
vote
2answers
272 views

SYN scan, TCP packet question

during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many One type of ID system, the ...
3
votes
1answer
715 views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
4
votes
1answer
3k views

Snort (IDS) Don't show Port Scans

I have install Snort & acidbase by this instruction and access it through this local address 127.0.0.1/acidbase/base_main.php The problem is after scan it with nmap by this command sudo ...
2
votes
1answer
503 views

snort ignores packets with matching src/dest IP address

This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
2answers
236 views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
390 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
532 views

Solutions to TCP FIN Host Sweep (Signature 3032)

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
3
votes
1answer
788 views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
1
vote
1answer
615 views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
2answers
280 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
1
vote
1answer
265 views

how to handle error reply messages?

For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
1answer
184 views

How to capture packet using agent in JADE (Java Agent Development Framework)?

I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
1
vote
2answers
364 views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
2
votes
1answer
189 views

Does Verizon Wireless LTE network have intrusion prevention capabilities?

Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM. EDIT for clarity: I ...
5
votes
1answer
120 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
1
vote
1answer
627 views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
127 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
1
vote
2answers
548 views

Where can I find worm traffic sample?

I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
2
votes
2answers
2k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
0
votes
1answer
278 views

Network anomaly detection or anomaly-based intrusion detection?

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
-3
votes
2answers
146 views

anomaly detection: feature calculation problem [closed]

I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ]) ...
0
votes
1answer
179 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
1answer
208 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
1answer
598 views

Why aren't anomaly-based intrusion detection schemes implemented in Snort?

I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
3
votes
1answer
363 views

Anomaly Intrusion Detection relevant features

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic. I found 41 features from KDD CUP'99 project (the paper: WENKE ...
1
vote
3answers
1k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
283 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
0
votes
1answer
516 views

Interpreting Snort's stream5 alerts

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index. Snort is showing me a huge amount of, in particular, these two ...
2
votes
1answer
451 views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
2
votes
2answers
70 views

Information disclosure by identifiers

I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue ...
1
vote
1answer
369 views

Examples for (Web-)Security-Architectures

I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
-2
votes
5answers
12k views

How to check if someone is in my computer [duplicate]

Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not? My only clue is that my mouse sometimes start to move randomly (it is not ...
6
votes
1answer
902 views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
13
votes
5answers
808 views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
2
votes
1answer
184 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
1
vote
1answer
538 views

Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
3
votes
2answers
168 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
2
votes
2answers
231 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
4
votes
2answers
479 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
5
votes
2answers
1k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
2
votes
4answers
601 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
4answers
359 views

Writing exploit code that bypasses IPS detection

Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit. If I modify the exploit code, are there IPS/IDS which will still ...
2
votes
2answers
478 views

How are signatures for IPS determined

For example , how do Snort's VRT team or some one who gives us the signatures, determine them at all ? I would be more interested to know , how are the traffic patterns analyzed against some known ...
4
votes
1answer
438 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
1
vote
0answers
178 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
4
votes
1answer
1k views

Bench marking Snort and other IDS/IPS

I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...